activitypub-http-signature

RFC 9421 Adoption

This document tracks adoption of RFC 9421 on the Fediverse.

Background

Most ActivityPub servers implement HTTP Signature for authenticating server-to-server requests. The Fediverse community adopted an early version of RFC 9421, draft-cavage-12, which is incompatible with the released version.

The ActivityPub and HTTP Signatures Report outlines how HTTP Signatures and particularly draft-cavage-12 are implemented on the Fediverse.

Some Fediverse software has begun implementing the release version of RFC 9421, using the double-knocking technique suggested in the Report, or using other techniques.

This tracking document can help implementers debug their own implementation, as well as deciding when it’s worthwhile to include RFC 9421 in their own servers.

Adoption matrix

This matrix is for tracking server implementation status of RFC 9421. The table has the following columns:

• Software: name and link to the software. This is for server software only, not for libraries.
• Accept for GET: validates incoming signatures GET requests
• Accept for POST: validates incoming signatures for POST requests
• Send for GET: signs outgoing GET requests with RFC 9421; whether it uses double-knocking or another strategy
• Send for POST: signs outgoing GET requests with RFC 9421; whether it uses double-knocking or another strategy
• Issue(s): one or more bug-tracking issues for the topic of RFC 9421 upgrade. Preferably a tracking issue across the board.

Thanks to FediDB for the seed version of the software list.

Software	Accept for GET	Accept for POST	Send for GET	Send for POST	Issue(s)
Activity-Relay	?	?	?	?	?
activitypub.bot1	✅ Y	✅ Y	✅ Y 2	✅ Y 2	#176
Activityrelay	?	?	?	?	?
Akkoma	❌ N	❌ N	❌ N	❌ N	1145
BadgeFed	?	?	?	?	?
Betula	?	?	?	?	?
Bonfire	✅ Y	✅ Y	✅ Y 3	✅ Y 3	7
Bookwyrm	?	?	?	?	?
Bridgy-fed	❌ N	❌ N	❌ N	❌ N	2635
Cherrypick	?	?	?	?	?
Drupal	?	?	?	?	?
Ecko	?	?	?	?	?
Emissary	❌ N	❌ N	❌ N	❌ N	608
Fedibird	?	?	?	?	?
Firefish	?	?	?	?	?
Forgejo	?	?	?	?	?
Forte	✅ Y	✅ Y	✅ Y 4	✅ Y 4	N
Foundkey	?	?	?	?	?
frequency	?	?	?	?	?
Friendica	?	?	?	?	?
Funkwhale	?	?	?	?	?
Gancio	?	?	?	?	?
Ghost	✅ Y	✅ Y	✅ Y 2	✅ Y 2	Fedify #208
GNU social	?	?	?	?	?
Gotosocial	❌ N	❌ N	❌ N	❌ N	4939
Hackers’ Pub	✅ Y	✅ Y	✅ Y 2	✅ Y 2	Fedify #208
Hollo	✅ Y	✅ Y	✅ Y 2	✅ Y 2	Fedify #208
Hometown	✅ Y 5	✅ Y 5	❌ N	❌ N	N/A
Honk	?	?	?	?	?
Hubzilla	✅ Y	✅ Y	✅ Y 4	✅ Y 4	N
Iceshrimp	?	?	?	?	?
irwin	?	?	?	?	?
Kmyblue	?	?	?	?	?
Ktistec	?	?	?	?	?
Lemmy	❌ N	❌ N	❌ N	❌ N	6647
Loops	?	?	?	?	?
Lotide	?	?	?	?	?
Manyfold	❌ N	❌ N	❌ N	❌ N	6871
Mastodon	✅ Y	✅ Y	❌ N 6	❌ N 6	29905
Mbin	?	?	?	?	?
Meisskey	?	?	?	?	?
Microblogpub	?	?	?	?	?
Microdotblog	❌ N	❌ N	❌ N	❌ N	RFC 9421
Misskey	❌ N	❌ N	❌ N	❌ N	17706
Mitra	✅ Y	✅ Y	?	?	?
Mobilizon	?	?	?	?	?
murlog	?	?	?	?	?
NeoDB	?	?	?	?	?
NodeBB	✅ Y	✅ Y	❌ N	❌ N	13382, 14622
Owncast	?	?	?	?	?
PeerTube	?	?	?	?	?
Piefed	?	?	?	?	?
Pixelfed	❌ N	❌ N	❌ N	❌ N	6590
Pleroma	?	?	?	?	?
Plume	?	?	?	?	?
Postmarks	?	?	?	?	?
Sharkey	?	?	?	?	?
Smithereen	?	?	?	?	?
Snac	?	?	?	?	?
stegodon	?	?	?	?	?
streams repository	✅ Y	✅ Y	✅ Y 4	✅ Y 4	N
Takahe	?	?	?	?	?
Threads	?	?	?	?	?
tootik	✅ Y	✅ Y	✅ Y	✅ Y	N/A
Vernissage	?	?	?	?	?
wafrn	?	?	?	?	?
Welley	✅ Y	✅ Y	✅ Y 7	✅ Y 7	N
WordPress	✅ Y	✅ Y	✅ Y 8	✅ Y 8	2859
WriteFreely	❌ N	❌ N	❌ N	❌ N	RFC 9421

1. tags.pub, groups.pub, activitypub.bot and others ↩

2. Double-knock. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸

3. https://docs.bonfirenetworks.org/federation-interoperability.html#7-http-signatures-secure-fetch ↩ ↩²

4. Supports double-knock, capability, and toggle on permanently via config. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶

5. Hometown (a fork of Mastodon) currently tracks Mastodon 4.5.x, which includes incoming RFC 9421 support. ↩ ↩²

6. Added in 4.7.0. Double-knock, but uses draft-cavage-12 first. PR ↩ ↩²

7. As a server configuration option, off by default. No double-knock yet: turning it on replaces draft-cavage-12 rather than falling back to it. Acceptance of both versions is always on and is independent of the outgoing setting. ↩ ↩²

8. As a server configuration option, off by default. ↩ ↩²